Question on Root Certificate

Kubernetes
#1

Hi,

In the “TLS in Kubernetes - Certificate Creation” lecture, I understand that the root certificate (e.g. "ca.crt" file) needs to be specified in "--trusted-ca-file" field for the ETCD server, so that it can verify its client.

At the 8:45 mark, it seems like the API server is trying to achieve the same objective via the "--client-ca-file". However, in this case, it is using the "ca.pem" file, which is different from the "ca.crt" file generated in the beginning of the lecture (e.g. it has actually never appeared in this lecture until this point).

image
image1920×1030 139 KB

Are both "ca.pem" and "ca.crt" referring to the same root certificate in this case?

Thank you.

#2

In this configuration, they do appear to be the same CA cert. This is not generally the case; very often etcd and kube-apiserver use different CAs.

1 Like
#3

Thank you for the confirmation Rob!